« Volver al listado

CVE-2025-48861

Estado: AplazadaMedia (5.3)—

A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Beckhoff — Ctrlx OSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48861",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48861",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-14T15:46:48.369443Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@bosch.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@bosch.com",
      "affectedData": [
        {
          "vendor": "Bosch Rexroth AG",
          "product": "ctrlX OS - Setup",
          "versions": [
            {
              "status": "affected",
              "version": "1.20.0",
              "versionType": "custom",
              "lessThanOrEqual": "1.20.1"
            },
            {
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.1"
            },
            {
              "status": "affected",
              "version": "3.6.0",
              "versionType": "custom",
              "lessThanOrEqual": "3.6.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-08-14T09:15:26.107",
  "references": [
    {
      "url": "https://psirt.bosch.com/security-advisories/BOSCH-SA-129652.html",
      "source": "psirt@bosch.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@bosch.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el endpoint de la API de tareas del mecanismo ctrlX OS setup permitió a un atacante remoto no autenticado acceder y extraer datos internos de la aplicación, incluidos posibles registros de depuración y la versión de las aplicaciones instaladas."
    }
  ],
  "lastModified": "2026-06-17T09:30:24.100",
  "sourceIdentifier": "psirt@bosch.com"
}